[aikido-autofix]

Which Linear task belongs to this PR?

Why did I implement it this way?

This patch mitigates a potential supply chain attack by pinning the version of third-party Github Actions to their commit SHA.

AI Confidence Level (confidence in the quality of this automated fix): High confidence: Aikido has a robust set of benchmarks for similar fixes, and they are proven to be effective.

Checklist before requesting a review

• I have performed a self-review of my code
• This pull request is as small as possible and only tackles one problem
• I have added tests that cover the functionality / test the bug
• For new facets: I have checked all points from this list: https://www.notion.so/lifi/New-Facet-Contract-Checklist-157f0ff14ac78095a2b8f999d655622e
• I have updated any required documentation

Checklist for reviewer (DO NOT DEPLOY and contracts BEFORE CHECKING THIS!!!)

• I have checked that any arbitrary calls to external contracts are validated and or restricted
• I have checked that any privileged calls (i.e. storage modifications) are validated and or restricted
• I have ensured that any new contracts have had AT A MINIMUM 1 preliminary audit conducted on by <company/auditor>

[aikido-autofix]

Closed by Aikido: the vulnerability is already resolved.